4 commits

Author	SHA1	Message	Date
Ullrich Schäfer	be3e69c10b	Security hardening: headers, scanning, Docker, firewall ... - Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy on all responses - Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403 - CI: Gitleaks secret scanning + pnpm audit for vulnerabilities - Dependabot: Weekly npm + GitHub Actions + monthly Docker updates - Docker: Non-root user in journal, planner, and brouter containers - Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned) - SECURITY.md: Vulnerability disclosure policy - Privacy page: Security practices section added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-25 09:58:12 +01:00
Ullrich Schäfer	52b2baaf58	Add local dev setup, fix BRouter Dockerfile, archive change (#12)	2026-03-22 23:11:43 +00:00
Ullrich Schäfer	f955fb9d6e	Fix BRouter Dockerfile: correct version and download URL (#3) ... - Version 1.7.7 → 1.7.8 (latest release) - Download URL needs v prefix on tag: v1.7.8 Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-22 13:37:18 +01:00
Ullrich Schäfer	7908a518b1	Add infrastructure: Terraform, Docker Compose, BRouter, CD pipeline (#2) ... Terraform: - Hetzner CX22 server with Docker, firewall (80/443/22) - SSH key and output for server IP Docker Compose: - Caddy reverse proxy (auto HTTPS) - Journal and Planner app containers - BRouter routing engine container - PostgreSQL + PostGIS - Garage S3 storage BRouter: - Dockerfile based on eclipse-temurin:11-jre - Segment download script for Germany (4 tiles, ~750MB) CD Pipeline: - Build & push Docker images to ghcr.io on main push - Deploy step commented out (enable when server provisioned) Scripts: - PostgreSQL daily backup with 14-day retention - Dockerfiles for both apps (multi-stage builds) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-22 13:32:01 +01:00